@Xstreem 

Regarding the profile point, it is correct. 

From official user guide:

When a network is created, the system will automatically create a profile with the same name and configure the network as the native network for the profile. In this profile, no networks are configured as Tagged Networks and Untagged Networks. The profile can be viewed, but not edited or deleted.

In case you needed, you can create another profile and choose the native vlan and untagged/tagged.

Regards

@Emitplink Thanks Emit for the answer, you are right this is intended but do you think has it sense in this way? Isn't better that the profile can be also edited ?

Regarding the ACL rules did you have chance to try any ? I'm also testing the rules for the router TL-R605, but I can't get even one to work for the gateway nor for the switch, the only one that work are the EAP rules.

Maybe I'm doing something wrong.

@Xstreem 

Yes, I agree with you about the profile. Probably is because the profile created is to set as native and untagged the new vlan interface created. You have to set it only if you want one particular port for that profile because the default ALL contain automatically all the vlans (this is useful for multiple SSID on EAPs for example.

Regarding ACL I just tried Switch ACL for different network and it works.